Skip to content

Vault

Encrypt, store, and control access to sensitive data

Paycux Vault is a developer-friendly EKM to encrypt and optionally store data including tokens, passwords, certificates, files, and any other customer content.

Get startedRead the docs
Vault
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

Powerful encryption. Simple integration.

Powerful. Simple. Flexible.

1

Powerful

Multiple layers of encryption protect data while keeping keys secure. Envelope encryption means the data key that touches your payload is itself wrapped by a key you never handle.

2

Simple

Encrypt content by using metadata to identify data keys. Pass the organisation, the user, or any context you like — Vault resolves the right key for you.

3

Flexible

Store data directly in Vault or generate keys for use in applications. Keep the ciphertext in your own database when that is the shape your system already has.

Encryption Key Management

EKM for enterprise-ready security

Paycux Vault provides secure storage and strict access control for any type of object data, with encryption of individual keys backed by an HSM.

  • Envelope encryption: data keys wrapped by key-encryption keys, never exposed in plaintext
  • HSM-backed protection of the root key material
  • Version-controlled objects, so a rotation never orphans old ciphertext
  • Guardrails by default — the API makes the safe path the short path
  • Data stays protected across its lifecycle: in transit, in use, and at rest
Encryption Key Management
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

Bring-Your-Own-Key

BYOK for the ultimate data control

Modern enterprise customers demand encryption with managed key services. Use Paycux-hosted keys, attach your own, or let your customers bring their KMS.

  • Integrates directly with AWS KMS, Google Cloud KMS, Azure Key Vault and HashiCorp Vault
  • Per-customer key isolation: one tenant's key can never decrypt another tenant's object
  • Context-based key generation tied to the user, the organisation, or any metadata you supply
  • Revoke a customer key and their data becomes undecryptable — including by you
  • HSM, CMK, KEK, DEK — disregard the acronyms and use encryption with simple tools
Bring-Your-Own-Key
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

Zero trust. Full control.

Enterprise-ready security.

Everything the security questionnaire asks about, available on day one rather than in the quarter after the deal closes.

Any object, anywhere in the stackEncrypt all secret and sensitive data, including customer PII, payment information, API tokens or passwords. Segment data according to its type, classification or relationships.
Envelope encryption and per-customer key segmentationGenerate data encryption keys to cryptographically protect data stored in internal systems. All keys are scoped to organisations, sessions or arbitrary context for optimised compute speed.
Audit every interaction with encrypted objectsA detailed log of all activity through observability telemetry. Pipe audit events into log aggregators, SOARs or SIEMs to monitor object and key use.
On-demand key rotation and revocationRotate keys on demand, on a schedule, or in any sequence using Vault's flexible key context. Restrict access to data by revoking keys, which disables decryption.
Field-level encryption for content separationScope encryption keys using content metadata to create logical segregation. Encrypt entire objects or individual fields based on data sensitivity.
Your keys or oursUse Paycux Vault hosted keys, attach your own, or let your customers bring their KMS — without changing a line of the code that calls the API.

Powerful encryption. Simple integration.

Programmatic access to version-controlled objects and data encryption keys.

The Paycux API enables adding enterprise-ready features to your application. Encrypting a value takes one call and a context.

1// Encrypt an object scoped to a single organization
2import Paycux from '@paycux/node';
3 
4const paycux = new Paycux('sk_example_123456789');
5 
6const organization = await paycux.organizations.getOrganization(
7  'org_01EHZNVPK3SFK441A1RGBFSHRT',
8);
9 
10const encryptedObject = await paycux.vault.createObject({
11  name: 'external_api_key',
12  value: 'supersecretapikey',
13  context: { organizationId: organization.id },
14});

Transparent pricing

Priced by encrypted object

Key management is included. You pay for the objects Vault stores and the data keys it issues — not for the number of engineers who call the API.

See full pricingTalk to an expert
Key management and rotationIncluded
Per-customer key isolationIncluded
Bring-your-own-key (KMS)Enterprise
Decrypt audit trailIncluded
Custom enterprise plansContact sales

Questions

Frequently asked

What is envelope encryption, in one sentence?

Your data is encrypted with a short-lived data key, and that data key is itself encrypted by a key-encryption key held in an HSM — so the key that touches your payload is never stored in the clear.

Do I have to store my data in Vault?

No. You can store objects in Vault, or ask Vault only for a data key and keep the ciphertext in your own database. Both paths use the same key hierarchy and the same audit trail.

What does per-customer key isolation actually buy me?

Each organisation gets its own key context, so a decrypt request carrying tenant A's context cannot read tenant B's ciphertext. It turns a logical tenancy boundary into a cryptographic one.

What happens when a customer asks us to delete their data?

Revoke their key. Every object encrypted under it becomes undecryptable immediately, which is a far faster and more provable answer than chasing rows across backups.

Can our security team see who decrypted what?

Yes. Every interaction with an encrypted object is logged with the actor, the context and the key version, and those events can be streamed into your own SIEM or SOAR.

Keep exploring

The rest of the platform

User ManagementComplete auth and user management platform
Enterprise SSOUnified SSO for any identity provider
RadarRealtime protection against bots, fraud and abuse
AuthKitCustomisable UI for every authentication type
Directory SyncUser lifecycle from corporate directories
Role-Based Access ControlPowerful and flexible permissions for your users

Keep it secret. Keep it safe.

Request access to begin securing sensitive data and secrets in your app today.

Get startedTalk to an expert